Privacy Policy

1. Who We Are

Risk Medical Rescue Limited is a registered company (Company No. 14329059) with its registered office at St Augustine's, 125 Canterbury Road, Westgate-On-Sea, Kent CT8 8NL. We are an independent provider of operational healthcare, event medical cover, patient transport, and accredited training.

We are registered as a data controller with the Information Commissioner's Office (ICO) and are responsible for the personal data we hold about you.

Data protection enquiries should be directed to: hello@riskmedicalrescue.co.uk.

2. The Data We Collect

2.1 General Personal Data

When you contact us, make a booking, or use our website, we may collect:

• Name, email address, telephone number
• Organisation name and job title
• Event details (for event medical enquiries)
• IP address and browser/device information via our website analytics
• Correspondence records

2.2 Special Category Health Data — Clinical Records

Where we provide clinical services (event medical cover, patient transport, remote or custodial healthcare), we create and maintain clinical records that may include:

• Registration and identification data (name, date of birth, contact details)
• Health screening records and pre-event declarations
• Informed consent records (for treatment, assessment, and data processing)
• Clinical assessment records (presenting complaint, observations, examination findings)
• Treatment records (medications administered, interventions, clinical decisions)
• Body maps and injury documentation
• Rehabilitation programmes and discharge plans
• Referral records and handover documentation
• Discharge summaries and follow-up communications

This clinical records set constitutes special category data under Article 9 of the UK GDPR and is subject to the additional safeguards described in this policy.

2.3 Training Data

For training course participants, we collect: name, contact details, qualification history, assessment records, and certification data required by our awarding bodies.

3. Legal Basis for Processing

We rely on the following lawful bases under UK GDPR:

• Article 6(1)(b) — Performance of a contract: to deliver the services you have requested.
• Article 6(1)(c) — Legal obligation: to comply with our regulatory and statutory duties.
• Article 6(1)(f) — Legitimate interests: for business administration and service improvement.
• Article 6(1)(a) — Consent: for marketing communications and non-essential cookies.

Special Category Health Data

For special category health data, we rely on the following additional conditions:

• Article 9(2)(c) — Vital interests: where processing is necessary to protect someone's life and they are physically or legally incapable of giving consent.
• Article 9(2)(h) — Healthcare provision: processing necessary for the provision of health care and treatment, and the management of health care systems and services.
• Article 9(2)(a) — Explicit consent: where we seek and rely on your explicit consent.

4. How We Use Your Data

• To deliver the clinical services you have requested
• To create and maintain clinical records as required by law and professional standards
• To comply with CQC requirements and our registration obligations
• To process training bookings and issue certificates
• To respond to enquiries and manage contractual relationships
• To meet our legal obligations (HSE reporting, safeguarding, statutory duties)
• To improve our services through anonymised audit and analysis

5. Clinical Records — Retention and Access

Clinical records created during the provision of medical services are retained in line with NHS Records Management Code of Practice and professional guidance:

• Adult patient records: minimum 8 years from last contact
• Children's records: retained until age 25 (or 26 if the young person was 17 at the conclusion of treatment)
• Maternity records: 25 years
• Mental health records: 20 years from last contact (or 8 years after death)

You have the right to access your clinical records. Subject access requests should be made in writing to hello@riskmedicalrescue.co.uk and are handled within one month.

6. Sharing Your Data

We share personal and clinical data only where strictly necessary and lawful, including with:

• NHS Ambulance Trusts and hospital emergency departments — for onward care and clinical handover
• Referring clinicians and GPs — where a clinical referral or continuity of care requires it
• CQC and regulatory bodies — where legally required
• Courts and statutory agencies — where required by law
• Training awarding bodies (Qualsafe Awards, IOCP) — to register and certificate learners
• IT service providers — under data processing agreements with appropriate safeguards

We do not sell personal data. We do not share clinical data for marketing purposes under any circumstances.

7. International Transfers

We do not routinely transfer personal data outside the UK. Where any processor operates outside the UK, we ensure appropriate safeguards are in place (such as UK adequacy regulations or International Data Transfer Agreements) to protect your data to UK GDPR standards.

8. Your Rights

Under UK GDPR, you have the following rights:

• Right of access — to a copy of the personal data we hold about you.
• Right to rectification — to correct inaccurate or incomplete data.
• Right to erasure — subject to legal and professional retention obligations.
• Right to restriction — to restrict processing in certain circumstances.
• Right to data portability — to receive data in a structured, machine-readable format.
• Right to object — to processing based on legitimate interests or direct marketing.
• Rights related to automated decision-making — we do not use automated decision-making or profiling.

To exercise any of these rights, contact: hello@riskmedicalrescue.co.uk.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Website Data & Cookies

Our website uses cookies and similar technologies. Non-essential cookies are only set with your consent. For full details, see our Cookie Policy.

10. Changes to This Policy

We review this Privacy Policy annually and update it whenever our practices change. Material changes will be highlighted on this page with a revised "last updated" date.